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1 Media Monitoring Capability Mission & Reporting Parameters: 

1.1 MMC Mission 

The MMC has three primary missions: 

• First - to continually update existing National Situation Summaries (NSS) and International 
Situation Summaries (ISS) with the most recent, relevant, and actionable open source media 
information 

• Second - to constantly monitor all available open source information with the goal of 
expeditiously alerting the NOC Watch Team and other key Department personnel of emergent 
situations 

• Third - to receive, process, and distribute media captured by DHS Situational Awareness Teams 
(DSAT) or other streaming media available to the NOC such as Northern Command's 
(NORTHCOM) Full Motion Video (FMV) and via open sources 

These three missions are accomplished by employing various tools, services, and procedures that 
are described in detail in this document. Expanded upon, these primary missions have three key 
components: 

1.1.1 Leverage Operationally Relevant Data 

Leveraging news stories, media reports and postings on social media sites concerning Homeland 
Security, Emergency Management, and National Health for operationally relevant data, 
information, analysis, and imagery is the first mission component. The traditional and social 
media teams review a story or posting from every direction and interest, utilizing thousands of 
reporters, sources, still/video cameramen, analysts, bloggers and ordinary individuals on scene. 
Traditional Media outlets provide unmatched insight into the depth and breadth of the situation, 
worsening issues, federal preparations, response activities, and critical timelines. At the same 
time, Social Media outlets provide instant feedback and alert capabilities to rapidly changing or 
newly occurring situations. The MMC works to summarize the extensive information from these 
resources to provide a well rounded operational picture for the Department of Homeland 
Security. 

1.1.2 Support NOC in Identifying Relevant Operational Media 

Supporting the NOC by ensuring they have a timely appreciation for evolving Homeland 
Security news stories and media reports of interest to the public and DHS/other federal agencies 
involved in preparations and response activities is the second key component. DHS and other 
federal agencies conducting joint operations may be affected by other evolving situations in that 
area. These situations may be related; have a cause and effect relationship; or be unrelated but 
have a detrimental effect. Through coordination with the NOC Duty Director (NDD), Senior 
Watch Officer (SWO) the MMC works to ensure the NOC Watch Team is aware of such stories 
and news events and has time to analyze any effect on operations. 



Timely reporting of current information is an integral element in maintaining complete 
operational awareness by Homeland Security Personnel. The MMC understand it is vital that 
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critical information is relayed to key Department decision makers in as expeditious a manner as 
possible. 

1.1.3 Increase Situational Awareness of the DHS Secretary 

Mitigating the likelihood that the Secretary and DHS Executive staffs are unaware of a breaking 
Homeland Security news story or media report is the third component. The Secretary and executive staff 
members are subject to press questions regarding domestic and international events and may or may not 
be informed of the most current media coverage. The MMC understands critical information 
requirements and monitors news coverage with the perspective of how the breaking story may be related 
to current and other important ongoing situations and DHS activities. 

The on-duty MMC analyst alerts DHS personnel and related federal agencies of updated news stories 
through distributed Items of Interest (see section 3.9.6). Recognizing that local media coverage is 
potentially sensationalizing an incident, the MMC strives to comprehend the media's message and 
identify sensitive situations that must be brought to the attention of the Secretary. 

1.2 Critical Information Requirements 

The attribution of IOIs by CIR allows the MMC to catalog articles into five specific categories depending 
on the potential impact or type of article that is being distributed. These CIRs include: 

1) Potential Threat to DHS, other federal, and state/ local response units, facilities, 
and resources. 

2) Potential impact on DHS capability to accomplish the HSPD-5 mission 

3) Identifying events with operational value. . .corroborating critical information 

4) Identifying media reports that reflect adversely on DHS and response activities 

5) Standing HSC planning scenarios 

1.3 Item of Interest Categorization 

The categorization of IOIs in the daily log allows analysts to track the types of articles that are 
distributed as they relate to 14 characterizations. These include: 

1) Terrorism: Includes media reports on the activities of terrorist organizations 
both in the United States as well as abroad. This category will also cover media 
articles that report on the threats, media releases by al Qaeda and other 
organizations, killing, capture, and identification of terror leaders and/or cells. 

2) Weather/Natural Disasters/Emergency Management: Includes media reports 
on emergency and disaster management related issues. Reports include 
hurricanes, tornadoes, flooding, earthquakes, winter weather, etc. (all hazards). 
Reports will outline the tracking of weather systems, reports on response and 
recovery operations, as well as the damage, costs, and effects associated with 
emergencies and disasters by area. Will also include articles regarding requests 
for resources, disaster proclamations, and requests for assistance at the local, 
state, and federal levels. 

3) Fire: Includes reports on the ignition, spread, response, and containment of 
wildfires/industrial fires/explosions regardless of source. 

4) Trafficking/Border Control Issues: Includes reports on the trafficking of 
narcotics, people, weapons, and goods into and out of the United States of an 
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exceptional level. Reports will also include articles outlining the strategy changes 
by Agencies involved in the interdiction of the items outlined above. 

5) Immigration: Includes reports on the apprehension of illegal immigrants, policy 
changes with regard to immigration in the United States, and border control 
issues. 

6) HAZMAT: Includes reports on the discharge of chemical, biological, and 
radiological hazardous materials as well as security and procedural incidents at 
nuclear facilities around the world, and potential threats toward nuclear facilities 
in the United States. Also included under this category will be reports and 
response to suspicious powder and chemical or biological agents. 

7) Nuclear: To include reports on international nuclear developments, attempts to 
obtain nuclear materials by terrorist organizations, and stateside occurrences such 
as melt downs, the mismanagement of nuclear weapons, releases of radioactive 
materials, illegal transport of nuclear materials, obtaining of weapons by terrorist 
organizations, and breaches in nuclear security protocol. 

8) Transportation Security: To include reports on security breaches, airport 
procedures, and other transportation related issues, and any of the above issues 
that affect transportation. Reports will include threats toward and incidents 
involving rail, air, road, and water transit in the United States. 

9) Infrastructure: Reports on national infrastructure including key assets and 
technical structures. Reports will include articles related to failures or attacks on 
transportation networks, telecommunications/ internet networks, energy grids, 
utilities, finance, domestic food and agriculture, government facilities, and public 
health, as well as those listed above. 

10) National/International Security: Includes reports on threats or actions taken 
against United States national interests both at home and abroad. Reports would 
include articles related to threats against American citizens, political figures, 
military installations, embassies, consulates, as well as efforts taken by local, 
state, and federal agencies to secure the homeland. Articles involving intelligence 
will also be included in this category. 

11) Health Concerns, National/International: Includes articles on national and 
international outbreaks of infectious diseases and recalls of food or other items 
deemed dangerous to the public health. 

12) Public Safety: Includes reports on public safety incidents, building lockdowns, 
bomb threats, mass shootings, and building evacuations. 

13) Reports on DHS, Components, and other Federal Agencies: Includes both 
positive and negative reports on FEMA, CIS, CBP, ICE, etc. as well as 
organizations outside of DHS. 

14) Cyber Security: Reports on cyber security matters that could have a national 
impact on other CIR Categories; internet trends affecting DHS missions such as 
cyber attacks, computer viruses; computer tools and techniques that could thwart 
local, state and federal law enforcement; use of IT and the internet for terrorism, 
crime or drug-trafficking; and Emergency Management use of social media 
strategies and tools that aid or affect communications and management of crises. 
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1.4 Department of Homeland Security (DHS) Component Agencies 

The Directorate for National Protection and Programs works to advance the Department's 
risk-reduction mission. Reducing risk requires an integrated approach that encompasses both 
physical and virtual threats and their associated human elements. 

The Directorate for Science and Technology is the primary research and development arm of 
the Department. It provides federal, state and local officials with the technology and capabilities 
to protect the homeland. 

The Directorate for Management is responsible for Department budgets and appropriations, 
expenditure of funds, accounting and finance, procurement; human resources, information 
technology systems, facilities and equipment, and the identification and tracking of performance 
measurements. 

The Office of Policy is the primary policy formulation and coordination component for the 
Department of Homeland Security. It provides a centralized, coordinated focus to the 
development of Department-wide, long-range planning to protect the United States. 

The Office of Health Affairs coordinates all medical activities of the Department of Homeland 
Security to ensure appropriate preparation for and response to incidents having medical 
significance. 

The Office of Intelligence and Analysis is responsible for using information and intelligence 
from multiple sources to identify and assess current and future threats to the United States. 

The Office of Operations Coordination and Planning is responsible for monitoring the 
security of the United States on a daily basis and coordinating activities within the Department 
and with governors, Homeland Security Advisors, law enforcement partners, and critical 
infrastructure operators in all 50 states and more than 50 major urban areas nationwide. 

The Federal Law Enforcement Training Center provides career-long training to law 
enforcement professionals to help them fulfill their responsibilities safely and proficiently. 

The Domestic Nuclear Detection Office works to enhance the nuclear detection efforts of 
federal, state, territorial, tribal, and local governments, and the private sector and to ensure a 
coordinated response to such threats. 

The Transportation Security Administration (TSA) protects the nation's transportation 
systems to ensure freedom of movement for people and commerce. 

United States Customs and Border Protection (CBP) is one of the Department of Homeland 
Security's largest and most complex components, with a priority mission of keeping terrorists 
and their weapons out of the U.S. It also has a responsibility for securing and facilitating trade 
and travel while enforcing hundreds of U.S. regulations, including immigration and drug laws. 
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United States Citizenship and Immigration Services secures America's promise as a nation of 
immigrants by providing accurate and useful information to our customers, granting immigration 
and citizenship benefits, promoting an awareness and understanding of citizenship, and ensuring 
the integrity of our immigration system. 

United States Immigration and Customs Enforcement (ICE), promotes homeland security 
and public safety through the criminal and civil enforcement of federal laws governing border 
control, customs, trade, and immigration. 

The United States Coast Guard is one of the five armed forces of the United States and the 
only military organization within the Department of Homeland Security. The Coast Guard 
protects the maritime economy and the environment, defends our maritime borders, and saves 
those in peril. 

The Federal Emergency Management Agency (FEMA) supports our citizens and first 
responders to ensure that as a nation we work together to build, sustain, and improve our 
capability to prepare for, protect against, respond to, recover from, and mitigate all hazards. 

The United States Secret Service (USSS) safeguards the nation's financial infrastructure and 
payment systems to preserve the integrity of the economy, and protects national leaders, visiting 
heads of state and government, designated sites, and National Special Security Events. 

1.5 DHS National Operations Center (NOC) Phases of Reporting 

1.5.1 NOC Notes 

NOC Notes are produced by the NOC whenever there is a situation that could potentially require 
federal assets such as personnel, equipment, or funding. In such cases, this would be an ongoing 
event and NOC-assigned number will be used for labeling and monitoring the situation (MMC 
will get notice via blast call, email, or pager). These IOIs have higher precedence over regular 
IOIs, but could either develop into a Steady State or become resolved rather quickly. These do 
not get added to the COP (only NSSs/ISSs), but the MMC will continue to publish IOIs on the 
event until the NOC determines that the situation has been resolved. 

1.5.2 Steady States 

Steady States are IOI's that have a higher precedence over general IOIs or NOC Notes (many 
Steady States are produced as a result of a NOC Note), but are not quite as relevant as NSSs or 
ISSs. Each of these covers a singular event continuously and could upgrade to an NSS or ISS 
item over a period of time depending on the situation. These do not get added to the COP, but 
the NOC and the MMC will continue to monitor such IOIs until the event has been resolved. 

1.5.3 National and International Situation Summary Updates 

Distributed National Situation Summary (NSS) Updates or International Situation Summary 
(ISS) updates are formatted in the same manner as all other types of IOIs, but are utilized to 
provide supplemental information for COP updates to active NSS/ISSs. These reports provide 
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the NOC Watch Team with a summary of media reports on a particular NSS/ISS and to increase 
the overall situational awareness of the NOC. The NSS/ISS updates include a brief synopsis of 
the incident's latest developments, an overview of broadcast television media coverage, and a 
summary of print news media coverage. 

For loading NSS/ISS updates to the COP, please refer to COP posting information beginning in 
Section 4.1.2, Media Monitoring User Page. Figure 7 is an example of the format for NSS/ISS 
updates. 

1.5.4 Events of High Media Interest of International Significance 

Periodically, there are events that the NOC constantly monitors - both national and international 
- and are listed on the NOC Priorities and Monitoring Report (Section 3.9.23, National 
Operations Center Priorities and Monitoring Report). The MMC will monitor such events to see 
if an IOI is warranted. Usually these events will be included in the OPSUM even though they 
may not seem to be a high priority for the NOC, and in this case, would simply be used to 
enhance situational awareness. Some of these events may be issued an NOC-assigned number 
and in this case, the MMC will publish IOIs in the same manner as it would for NOC Notes, 
Steady States, or NSSs/ISSs. These do not get added to the COP unless the NOC directs the 
MMC to do so. 

1.5.5 NOC Numbered Items 

On occasion, the NDD/SWO will determine that an incident is worth tracking; however it may 
not be substantial enough to warrant the generation of a higher level report, such as a NOC Note, 
Steady State or Phase Report. 

NOC Numbers may be utilized for any type of incident, and usually follow the [NOC #0000-00: 
Incident Title] format. However, if an incident falls under the Public Safety or Suspicious 
Activity category, the NOC may issue an item in the [NOC #0000-00-000: Incident Title] 
format. In those cases, incidents will be issued one of the following NOC Numbers, with the 
addition of a 3-digit tracking number at the end: 

• NOC #0012-11: Suspicious Activity - Chemical, Biological, Radiological, Nuclear or 
Explosive (CBRNE): covering any suspicious incident which may involve a CBRNE or 
CBRNE threat. 

• NOC #0013-11: Suspicious Activity: Covers any suspicious incident which does not 
involve a CBRNE 

• NOC #0014-11: Public Safety/Unusual Activity: Covers any incident that is not 
suspicious in nature, but needs further information or tracking 

Example: NOC 0012-11-295 [Suspicious Powder, Anchorage, AK] 

If included on the NOC Priorities list for the day, these incidents will be summarized in the 
OPSUM. 
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2 Items of Interest (IOI): 

MMC coverage focuses primarily on providing information on incidents of national significance, 
which are usually defined as catastrophic events that result in wide-scale damage or disruption to 
the nation's critical infrastructure, key assets, or the Nation's health; and require a coordinated 
and effective response by Federal, State, and Local entities. For the most part, coverage of 
international incidents is limited to that of terrorist activities and infectious diseases that impact a 
wide population of humans or animal stock, such as mad cow disease or H5N1, and catastrophic 
weather events around the globe (Category 5 Hurricanes, Tsunami, and Large Magnitude 
Earthquakes). An Item of Interest (IOI) is generated whenever an MMC search or alert produces 
information about an emergent incident that should be brought to the attention of the NOC. 

Note - Reports that pertain to DHS and sub agencies - especially those that have a negative spin 
on DHS/Component preparation, planning, and response activities should be reported to 
management before being sent to the distribution list. Senior TSI personnel will decide whether 
the information should be reported through normal channels. If there are ANY questions about 
whether an incident or other reported item is a valid IOI article check with management. 

2.1 Incidents that Warrant an IOI 

Terrorist incidents (including foreign countries) 

Major natural disasters (e.g., floods, tornadoes, earthquakes) 

Transportation incidents where major bottlenecks may occur or chemical/explosive 

hazards exist 

Incidents that could result in injury to a local population (e.g., fire at a chemical 

production facility releasing toxic fumes) 

Incidents that result in damage to critical infrastructure 

• Safety issues (e.g., aircraft emergency) 

• Certain crimes (e.g., snipers, mall/school shootings, major drug busts, illegal 
immigrant busts, etc). 

• Policy directives, debates, and implementations related to DHS 



• 



2.2 IOI Severity Chart 

The Item of Interest (IOI) Severity Chart is a tool that provides MMC analysts with a process to 
assess the severity of a news story and the urgency in which the corresponding IOI should be 
distributed. Determining the severity of an IOI allows analysts to triage news stories and send 
out time-sensitive pieces first, followed by less acute stories. The IOI Severity Chart is broken 
down into five categories, from "Urgent" to "Validate." Each category explains the threat 
assessment, when distribution should occur, and the probable source. So, for example, if an 
analyst has two stories that are fit to distribute, the analyst will use the Severity Chart to 
determine the order of distribution and follow-ups. Let's say the analyst has one story on an 
explosion at a subway stop in New York City and another story on a policy change to passport 
purchases. According to the IOI Severity Chart, the explosion falls into Category 2, "Critical," 
and requires immediate distribution. The change in passport purchase policy falls into Category 
4, "Routine," and has a more lax distribution protocol. In this instance, the analyst would 
immediate distribute the story on the explosion at a subway stop in New York City. Only after 
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additional follow-ups on the outcome and cause of the explosion would the second article on 
passport policy be distributed. 



Category 


Threat Assessment 


Distribution 


Probable Source 


- 1 Catastrophic: Bombing with casualties 

1 (excluding Afghanistan and Iraq), tsunami, mass 
1 shootings, terrorist attack, train derailment with 
1 mass causalities, major attack and/or destruction 
of U.S. infrastructure. 


Immediate 


Breaking news on National 

Broadcast (Fox News, CNN, etc.). 

Foreign and Regional press (BBC, 

Sky News, etc.) Story has not yet 

reached national or local print. 


2 — Critical 


Highly destructive/pases a threat to a large 

group of people and or resources: HAZMAT 

situation, tornado, hurricane, wildfires, mass 

flooding, publicized terronst threat, suspicious 

package and/or substance, harm (accidental or 

intentional) to a large group of people and/or 

resources. 


Immediate 


Breaking news on National 

Broadcast (Fox News, CNN, etc.) 

and national and/or local print. 


3 — ftionty 


Low threat to a specific area, potential for 
incident to upgrade to Category 1 and or 2: 

Border patrol incidents (with violence), severe 

weather, health concerns/recalls, train 

derailment, chemical spill, etc. 


After Category 1 and 2 stones 

and follow-ups have been 

released by MMC. 

The story has been reviewed 
for timeliness and accuracy. 


National and/or local print, UK 
news (BBC, Sky News). 


4 — Routine 


Of Interest: 

Border incidents (with no violence), drug busts, 

localized crime and/or related incidents, 

immigration, additional articles that are not 

subjective in nature. 


When there is a significant lull 

in MMC releases and after the 

story has been verified from 

several sources. 


National and/or local print. 

Western European and Canadian 

news sources- 


5 - Validate 


Subjective: 

Reports on federal agencies, (particularly as 
related to DHS activity), research/ studies, etc. 


Upon verification from Brad 

Mitch, Ray, or one of the team 

leads. 


Local print, medical reviews, 

foreign news agencies (with the 

exception of Western Europe and 

Canada). 



It is important to note that although the IOI Severity Chart provides guidance in detennirhng the 
categoiy of a potential IOI, there will be tunes when a story fails to fall into a specific category . 
When in doubt of whether an article should be distributed, it is the analyst's responsibility to 
contact one of the managers or team leads to receive direction and confirmation on handling the 
IOI in question. 

2.3 Notification of MMC Management 

TSI management is an integral part of MMC operations are to be used to augment understanding 
and proficiency of MMC policies and procedures. When there is ever a question that cannot be 
answered through the SOP or the analyst's own deductive reasoning, then the analyst must call 
TSI management to receive proper guidance. Times when you must call Brad, Mitch or Ray (or 
others when directed) are when: 

• Something significant has occurred 

• A particular report seems IOI worthy, but there are no corroborating reports 
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The initial IOI worthy report and the corroborating report are not from the source list we 

typically use 

The IOI worthy report reflects negatively on DHS or some other federal agency 

It appears the IOI worthy report will require numerous updates and potentially be an 

enduring topic 

You are not sure if an event has already been reported during a previous watch 

You feel a correction must be issued 

You are experiencing system problems - even if you have addressed them 

Whenever you have had to employ your backup 

You are simply not sure about a particular report and want a second opinion 

You have been given special instructions from DHS-related personnel such as the NOC 

SWO 



2.4 Critical Information Requirements 

The attribution of IOIs by CIR allows the MMC to catalog articles into five specific categories 
depending on the potential impact or type of article that is being distributed. These CIRs include: 

1) Potential Threat to DHS, other federal, and state/ local response units, facilities, and 
resources. 

2) Potential impact on DHS capability to accomplish the HSPD-5 mission 

3) Identifying events with operational value. . .corroborating critical information 

4) Identifying media reports that reflect adversely on DHS and response activities 

5) Standing HSC planning scenarios 



2.5 IOI Categorization 

1) Terrorism: Includes media reports on the activities of terrorist organizations 
both in the United States as well as abroad. This category will also cover media 
articles that report on the threats, media releases by al Qaeda and other 
organizations, killing, capture, and identification of terror leaders and/or cells. 

2) Weather/Natural Disasters/Emergency Management: Includes media reports 
on emergency and disaster management related issues. Reports include 
hurricanes, tornadoes, flooding, earthquakes, winter weather, etc. (all hazards). 
Reports will outline the tracking of weather systems, reports on response and 
recovery operations, as well as the damage, costs, and effects associated with 
emergencies and disasters by area. Will also include articles regarding requests 
for resources, disaster proclamations, and requests for assistance at the local, 
state, and federal levels. 

3) Fire: Includes reports on the ignition, spread, response, and containment of 
wildfires/industrial fires/explosions regardless of source. 

4) Trafficking/Border Control Issues: Includes reports on the trafficking of 
narcotics, people, weapons, and goods into and out of the United States of an 
exceptional level. Reports will also include articles outlining the strategy changes 
by Agencies involved in the interdiction of the items outlined above. 
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5) Immigration: Includes reports on the apprehension of illegal immigrants, policy 
changes with regard to immigration in the United States, and border control 
issues. 

6) HAZMAT: Includes reports on the discharge of chemical, biological, and 
radiological hazardous materials as well as security and procedural incidents at 
nuclear facilities around the world, and potential threats toward nuclear facilities 
in the United States. Also included under this category will be reports and 
response to suspicious powder and chemical or biological agents. 

7) Nuclear: To include reports on international nuclear developments, attempts to 
obtain nuclear materials by terrorist organizations, and stateside occurrences such 
as melt downs, the mismanagement of nuclear weapons, releases of radioactive 
materials, illegal transport of nuclear materials, obtaining of weapons by terrorist 
organizations, and breaches in nuclear security protocol. 

8) Transportation Security: To include reports on security breaches, airport 
procedures, and other transportation related issues, and any of the above issues 
that affect transportation. Reports will include threats toward and incidents 
involving rail, air, road, and water transit in the United States. 

9) Infrastructure: Reports on national infrastructure including key assets and 
technical structures. Reports will include articles related to failures or attacks on 
transportation networks, telecommunications/ internet networks, energy grids, 
utilities, finance, domestic food and agriculture, government facilities, and public 
health, as well as those listed above. 

10) National/International Security: Includes reports on threats or actions taken 
against United States national interests both at home and abroad. Reports would 
include articles related to threats against American citizens, political figures, 
military installations, embassies, consulates, as well as efforts taken by local, 
state, and federal agencies to secure the homeland. Articles involving intelligence 
will also be included in this category. 

11) Health Concerns, National/International: Includes articles on national and 
international outbreaks of infectious diseases and recalls of food or other items 
deemed dangerous to the public health. 

12) Public Safety: Includes reports on public safety incidents, building lockdowns, 
bomb threats, mass shootings, and building evacuations. 

13) Reports on DHS, Components, and other Federal Agencies: Includes both 
positive and negative reports on FEMA, CIS, CBP, ICE, etc. as well as 
organizations outside of DHS. 

14) Cyber Security: Reports on cyber security matters that could have a national 
impact on other CIR Categories; internet trends affecting DHS missions such as 
cyber attacks, computer viruses; computer tools and techniques that could thwart 
local, state and federal law enforcement; use of IT and the internet for terrorism, 
crime or drug-trafficking; and Emergency Management use of social media 
strategies and tools that aid or affect communications and management of crises. 
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2.6 Credible Sources for Corroboration 

First Tier - A first tier source is one that does not typically need additional corroboration prior 
to release. Sources that construct the first tier platform include major news networks, such as 
CNN and Fox; major newspapers, such as USA Today and The Washington Post; and 
international news, such as the BBC and The International Herald Tribune. These sources do not 
typically need additional corroboration prior to release 

o Major news networks (Television and Internet) 

■ CNN, FOX, ABC, NBC, CBS, MSNBC, Associated Press, Reuters (local 
affiliates of these major networks can be considered Tier 1 sources) 

■ Local affiliates of major networks, preferably sourced by the wire services 
like AP or Reuters 

O Major newspapers 

■ Washington Post, LA Times, USA Today, US News and World Report, Wall 
Street Journal, Chicago Tribune, Houston Chronicle, Boston Globe, Arizona 
Republic, San Francisco Chronicle, Detroit Free Press, Miami Herald 

■ Some major local/state newspapers are appropriate as well (New York Daily 
News, Chicago Sun Times, Minneapolis Star Tribune, Seattle Times, etc.) 

o International News 

■ BBC, Sky News, UPI (United Press International), IHT (International Herald 
Tribune), AFP (Agence France-Presse), Asian Times Online, Al Jazeera English, 
Prensa Latina (Latin American News Agency), The Guardian, Le Monde 
(France), The Economist, Kyodo News (Japan), The Australian News, German 
News, Canada Free Press, Agenzia Italia, United News of India, EFE (Spain), 
ARI (Russian Information Agency), 

Second Tier - Should ideally be verified by a First Tier source prior to release. 

o Government or specialized sites with a specific focus. Often includes .org's, .net's, 
and .co's. 

■ AllAfrica.com, Emergency and Disaster Management Service, 
GlobalSecurity.org, etc. 

o Obviously partisan or agenda-driven sites 

■ MoveOn.org, Amnesty International, etc. 

Third Tier - Must be verified by a First Tier source prior to release. 
o Tabloids (national and international) 

■ The Sun (UK), National Enquirer, Star, etc. 
O Blogs, even if they are of a serious, political nature 
O Popular magazines 

■ People Weekly, Washingtonian, etc. 

Fourth Tier - Must be verified by a First Tier source prior to release 
o News collection/ compilation sites 

■ NationalTerrorAlert.com, Drudge Report.com, DisasterNews.net, 
Opensourceintelligence.org, Homelandsecurityleader.com, 
HomelandSecurityToday.com. 



14 



Analyst's Desktop Binder 2011 



2.7 SourcinglOIs 

1) Credible Source: The item of interest was distributed following information 
provide by a credible source, such as a twitter posting by a media outlet 

2) Credible Evidence: Information is provided by social media sources, but is being 
redistributed by other users or media outiets, lending credibility 

3) Corroborating "Hits" Indicating a Trend: The item of interest was produced 
from multiple social media different sources providing an overall picture of the 
event 

4) Official Alert: A notification posted by an official government or private sector 
source 



2.8 IOI Distribution Lists 

There are different types of distribution lists that the MMC uses. Each one addresses a particular group, 
depending on the severity of the event. The following is a listing of the different lists and the purpose of 
each. In rare cases, one or more lists will be allowed for use. 

1) Default - this is a full distribution (FULLDIS) list that (more than just NOC personnel 
listed) is primarily used for IOIs pertaining to terror attacks/terrorism stories, 
border/immigration issues, natural disasters, wildfires, floods, drugs/drug violence, mass 
killings/shootings, domestic oil spills, health concerns, etc. 

2) LIMDIS - this is a Limited Distribution List that consists primarily to certain DHS, 
NOC, and TSI Leadership. IOIs that are sent utilizing the LIMDIS list are major traffic 
disruptions, suspicious package/powder incidents, hazmat, and school lockdowns. 

3) SN-Only - this is reserved for the SN team and includes specific members of the DHS 
Privacy office. 

4) SPECDIS - also known as Special Distribution List, is determined by Management and 
is used in rare cases, unusual events, or for certain individuals. 

5) TSI Test - used for training and test purposes. 

Note: For a current copy of any of the above IOI distribution lists, please refer to management and 
request that distribution list be sent to you. 



2.9 Creating IOIs (Traditional Media Application) 

The MMC team utilizes the App as its regular method for distributing IOIs. The App is a 
worksheet like function that requires the analyst to input data into specific fields, resulting in a 
correctly formatted IOI once published. The App automatically databases each item that is 
distributed, which results in an automated numbering of distributions. This means that when 
creating an IOI, the new report will be sequentially numbered, building on previous distributions. 
When analysts are generating an update for an IOI, they only have to make sure that they are 
updating the correct string (incident) and the App will automatically ensure that it is correctly 
numbered. 
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Analysts are responsible for: 



Generating a subject line that summarizes the main points of the article in a clear 

and concise manner and entering it hi the proper field. 

Copying and pasting the article's original title into the proper field. 

Selecting the correlating CIR# from the drop down menu. 

Selecting the most specific location possible from the drop down menu. 

Copying and pasting relevant points from the article into the text field. 

Identifying the specific media source and entering it in the proper field 

Copying and pasting the source link into the correct field 

Selecting the method used to find the article (Sourcmg) 

Inserting tags (keywords) 

Selecting correct distribution list (Default, Linidis, Specdis, SN Only) 

Proofing the entire report 

Verifying that the format is conect 



> MMC: Add Report - Mozilla Firefox 



File Edit View 



Bookmarks Tools Help 



- C X ta> iGMS 



report_m.aspx?sessionID=12933411744312500D&reportType=2&reporvj' -\ \^M" Google 



l Most Visited ™ Setting Started Latest Headlines Q 5W Suspicious Vehicle 



Analyst's Subject Title 



Article Title 



Event Location 



Article Text 



Tags 



Source Title 



Link 



P 



CIR Selection 
Drop Down Menu 



Category Drop 
Down Menu 
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2.10 Creating IOIs (Social Media Application) 

The SN team utilizes the App as its regular method for distributing IOIs. The App is a worksheet 
like function that requires the analyst to input data into specific fields, resulting in a correctly 
formatted IOI once published. The App automatically databases each item that is distributed, 
which results in an automated numbering of distributions. This means that when creating an IOI, 
the new report will be sequentially numbered, building on previous distributions. When analysts 
are generating an update for an IOI, they only have to make sure that they are updating the 
correct string (incident) and the App will automatically ensure that it is correctly numbered. 

Analysts are responsible for: 

• Generating a subject line that summarizes the main points of the article in a clear 
and concise manner and entering it in the proper field. 
Selecting the correlating CIR# from the drop down menu. 
Selecting the most specific location possible from the drop down menu. 
Pulling relevant points from multiple social media sources and generating a 
concise summary in the text field 

Identifying the social media sources and entering them in the proper field 
Copying and pasting the source links/social media postings into the correct field 
Selecting the method used to find the article (Sourcing) 
Inserting tags (keywords) 

Selecting correct distribution list (Default, Limdis, Specdis, SN Only) 
Proofing the entire report 
Verifying that the format is correct 



M"<W|-HI»T'i«BH 



■uiJ I 



Analyst's Subject Title 



Summary of Social 
Media postings 



Kevword Taes 
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2.11 Outlook Back-Up Procedure 

If the App is unavailable, analysts can generate an IOI via Microsoft Outlook using the following 
process: 

• Open a new message in the Outlook program 

• Insert the format text into the message or type layout. An easy way to get the 
format is to copy it from a previous IOI 

• Copy and paste the title of the article into the Title line and generate a subject line 
that reflects the main points of the incident. When applicable, include a location. 

• Add the location of the incident. Ensure this is the actual incident site and not the 
location of the journalist or news source. 

• Select the CIR # that best corresponds to the incident. 

• Insert the article's text. 

• Insert the article's source and link. 

Unfitted - Message IHTMU . r x 

otmfltfc 



§! IS&ttQ 



J 



"W 



Ooiqns Formatted: 



jf FcrnaE Painter 



Times New '16 'A.' a' := T 



_~jjj S^| ^ M ^ ! High Important 



|B / D "ty ' A ' =: = := ~K ~'K: Address Chcri Attach Attach Busmws Calendar Signature FolltJt; a. LowJmpilrtariLe Spelling 
— — — =— v - ' : " '""' Bnok Hames File Item Card' Up* 



: . . 



This mciH-ge ha: not bttn icni 



Hi 



Subject: 



: 



NOC Media Monitoring Capability - Traditional Media 

Title: 

Location: 

NOC MMC CIR #3: Idenflfyrng events with operational whir ...corroborating r irlic al information 

Excerpt from News Articlefs}; 

Sources (some page content may change or not be available over time): 

Source Name 

Link 



[Analyst Name] 

Operations Analyst 

DHS TOC Media Motoring . 



b (6) 
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2.12 Correction Notices 

Correction notices are issued in the event incorrect information is distributed in an IOI. The 
magnitude of misinformation can range from a misspelled word to a missing link. Whenever 
the analyst finds a mistake in a distribution after the item is sent, the first step the analyst will 
take is to contact management and inform management of the mistake. 

Management will review the severity of the mistake and determine whether a correction 
notice will be issued. Under no circumstance will the analyst send out a correction notice 
without managerial approval. If an IOI is numbered wrong, a correction notice usually is not 
issued. Update the log with the correct IOI number and ensure the succeeding IOI is 
correcdy numbered. 

It should be noted that although MMC strives to send high quality work, mistakes at times do 
occur. Taking time to thoroughly review an IOI prior to distribution and maintaining a high 
degree of attention to detail will keep mistakes to a minimum. When a correction notice is 
required, the analyst will draft a brief summary detailing the error and providing corrected 
information. This summary will be bold and placed at the top of the IOI, before the rest of the 
report. The word CORRECTION: will also be placed at the beginning of the IOIs subject 
line. 

Sample Subject Line: CORRECTION: U.S. Army Soldier Reportedly Among 3 Cartel 
Hitmen Arrested In Ciudad Juarez - Chihuahua, Mexico— MMC IOI #6836-11 

Sample Correction Summary: CORRECTION: The location of the news station KTSM 
was incorrectly reported as "El Paso, NM" and should have read "El Paso, TX". The 
correction has been made in this distribution. 
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ORRECTlOPi U.S, Army Sr, Idler Hcprted y among i Cartd Hitmen Arreted ii Cm did tarrs - ChitiuahuB, Me<i::--MMl L.l~3ii-U - Mss-sarjElHTML) 



,B-&~ 



Message | fristit Options F-arrnai Tort 



u 



frotsNew- 12 



i A't-h=='J5' |l^ 



Fasti 
T 7 Format Fainter 



C i:cad 



rt"/ llll*'' A-l|= = = |* S| 
Basic lent 3 



if sign r 



iJJ -.,: II <:k 

Book Names 
Names 



-::.:■-■ fttddi Rj : ineis calendar signature Follow 
File Item Card" * Up* 
JnrJnde '• 



Subject; CORRECTION; U.5, Aimy Sd-qici =LepertrdlyAn 'rig] Cartel HrtmenMetfrdtn CiudadJuarei -Chihuahua Moiw-MMC 10] *5S3G-11 




Subject line should now read: 

"CORRECTION: U.S. Army Soldier Reportedly 
Among 3 Cartel Hitmen Arrested In Ciudad 
Juarez - Chihuahua, Mexico — MMC IOI #6836- 
11 



CORRECTION: The location of the Dews station KTSMwas meorre-efh" reported as "El Pa so, MF and should have road "El Paso. TX W . The correction has been made in this 

distribution. 

Location: Ciudad Juarez, Chihuahua, Mexico 



* eCTSMin E] Paso. T!v, and Juarez media report that one of three carrel-Linked j'.itmen arrested Wednesday in Ciudid Juarez is an active duty U S Armv soldier 

o Authorities claim thernari identified himself as a U i Army soldier daring his arrest and that his status ss~as confirmed by police personnei 

■ His claim has not been confirmed bv ITS authohties 
o There ivas no immediate report of ssfiat carte! tie man may he linked to 

• AccDrding to auttunriries. ill three men confesseri t rj taidn e put in the xiurdas of four JaEttez police officers between 7-8 September 



\esv Media Sources (some page content may change or not b e assailable over rime): 

- Twitter [KTSM-TYJ 

- http:..'twitte{,com^!,NC9'Stanises. , 34497]88336tB89S24 
-Borderland Beat 

- htsn lAnvTf.h o:d emdbeat .com.- 

(Analyst Name) 
Operations, Analyst 
TjTTSNOC Meilia Mtmitoriiis 



A brief explanation is given just 
below the subject line in the 
body of the IOI. 



(b) (6) 



2.13 Keywords & Search Terms 

This is a current list of terms that will be used by the NOC when monitoring social media sites to 
provide situational awareness and establish a common operating picture. As natural or manmade disasters 
occur, new search terms may be added. The new search terms will not use PE1 in searcliiiig for relevant 
mission-related infonnation 



DHS & Other Agencies 

Department of Homeland 

Security (DHS) 

Federal Emergency 

Management Agency 

(FEjVLA) 

Coast Guard (USCG) 

Customs and Border 

Protection (CBP) 

Border Patrol 

Secret Service (USSS) 

National Operations Center 

(NOC) 

Homeland Defense 



Immigration Customs 

Enforcement (ICE) 

Agent 

Task Force 

Central Intelligence Agency 

(CIA) 

Fusion Center 

Drug Enforcement Agency 

(DEA) 

Secure Border Initiative 

(SBI) 

Federal Bureau of 

Investigation (FBI) 



Alcohol Tobacco and 

Firearms (ATF) 

U.S. Citizenship and 

Immigration Services (CIS) 

Federal Air Marshal Service 

(FAMS) 

Transportation Security 

Adniinistration (TSA) 

Air Marshal 

Federal Aviation 

Administration (FAA) 

National Guard 

Red Cross 

United Nations (UN) 
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Domestic Security 






Assassination 


Emergency management 


Gangs 


Attack 


Emergency response 


National security 


Domestic security 


First responder 


State of emergency 


Drill 


Homeland security 


Security 


Exercise 


Maritime domain awareness 


Breach 


Cops 


(MDA) 


Threat 


Law enforcement 


National preparedness 


Standoff 


Authorities 


initiative 


SWAT 


Disaster assistance 


Militia 


Screening 


Disaster management 


Shooting 


Lockdown 


DNDO (Domestic Nuclear 


Shots fired 


Bomb (squad or threat) 


Detection Office) 


Evacuation 


Crash 


National preparedness 


Deaths 


Looting 


Mitigation 


Hostage 


Riot 


Prevention 


Explosion (explosive) 


Emergency Landing 


Response 


Police 


Pipe bomb 


Recovery 


Disaster medical assistance 


Incident 


Dirty bomb 


team (DMAT) 


Facility 


Domestic nuclear detection 


Organized crime 




HAZMAT & Nuclear 






Hazmat 


Leak 


Gas 


Nuclear 


Biological infection (or 


Spillover 


Chemical spill 


event) 


Anthrax 


Suspicious package/device 


Chemical 


Blister agent 


Toxic 


Chemical burn 


Chemical agent 


National laboratory 


Biological 


Exposure 


Nuclear facility 


Epidemic 


Burn 


Nuclear threat 


Hazardous 


Nerve agent 


Cloud 


Hazardous material incident 


Ricin 


Plume 


Industrial spill 


Sarin 


Radiation 


Infection 


North Korea 


Radioactive 


Powder (white) 




Health Concern + H1N1 






Outbreak 


Salmonella 


Agriculture 


Contamination 


Small Pox 


Listeria 


Exposure 


Plague 


Symptoms 


Virus 


Human to human 


Mutation 


Evacuation 


Human to Animal 


Resistant 


Bacteria 


Influenza 


Antiviral 


Recall 


Center for Disease Control 


Wave 


Ebola 


(CDC) 


Pandemic 


Food Poisoning 


Drug Administration (FDA) 


Infection 


Foot and Mouth (FMD) 


Public Health 


Water/air borne 


H5N1 


Toxic 


Sick 


Avian 


Agro Terror 


Swine 


Flu 


Tuberculosis (TB) 


Pork 
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Strain 
Quarantine 
H1N1 
Vaccine 



Tamiflu 
Norvo Virus 
Epidemic 



World Health Organization 
(WHO) (and components) 
Viral Hemorrhagic Fever 
E. Coli 



Infrastructure Security 






Infrastructure security 
Airport 


Airplane (and derivatives) 
Chemical fire 




CIKR (Critical Infrastructure 


Subway 


Electric 


& Key Resources) 


BART 


Failure or outage 


AMTRAK 


MARTA 


Black out 


Collapse 


Port Authority 


Brown out 


Computer infrastructure 


NBIC (National 


Port 


Communications 


Biosurveillance Integration 


Dock 


infrastructure 


Center) 


Bridge 


Telecommunications 


Transportation security 


Cancelled 


Critical infrastructure 


Grid 


Delays 


National infrastructure 


Power 


Service disruption 


Metro 
WMATA 


Smart 

Body scanner 


Power lines 


Southwest Border Violence 






Drug cartel 


Fort Hancock 


Gunfight 


Violence 


San Diego 


Trafficking 


Gang 


Ciudad Juarez 


Kidnap 


Drug 


Nogales 


Calderon 


Narcotics 


Sonora 


Reyosa 


Cocaine 


Colombia 


Bust 


Marijuana 


Mara salvatrucha 


Tamaulipas 


Heroin 


MS13orMS-13 


Meth Lab 


Border 


Drug war 


Drug trade 


Mexico 


Mexican army 


Illegal immigrants 


Cartel 


Methamphetamine 


Smuggling (smugglers) 


Southwest 


Cartel de Golfo 


Matamoros 


Juarez 


Gulf Cartel 


Michoacana 


Sinaloa 


La Familia 


Guzman 


Tijuana 


Reynosa 


Arellano-Felix 


Torre on 


Nuevo Leon 


Beltran-Leyva 


Yuma 


Narcos 


Barrio Azteca 


Tucson 


Narco banners (Spanish 


Artistic Assassins 


Decapitated 


equivalents) 


Mexicles 


U.S. Consulate 


Los Zetas 


New Federation 


Consular 


Shootout 




El Paso 


Execution 
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Terrorism 






Terrorism 


IED (Improvised Explosive 


Suspicious substance 


Al Qaeda (all spellings) 


Device) 


AQAP (AL Qaeda Arabian 


Terror 


Abu Sayyaf 


Peninsula) 


Attack 


Hamas 


AQIM (Al Qaeda in the 


Iraq 


FARC (Armed Revolutionary 


Islamic Maghreb) 


Afghanistan 


Forces Colombia) 


TTP (Tehrik-i-Taliban 


Iran 


IRA (Irish Republican Army) 


Pakistan) 


Pakistan 


ETA (Euskadi ta Askatasuna) 


Yemen 


Agro 


Basque Separatists 


Pirates 


Environmental terrorist 


Hezbollah 


Extremism 


Eco terrorism 


Tamil Tigers 


Somalia 


Conventional weapon 


PLF (Palestine Liberation 


Nigeria 


Target 


Front) 


Radicals 


Weapons grade 


PLO (Palestine Liberation 


Al-Shabaab 


Dirty bomb 


Organization 


Home grown 


Enriched 


Car bomb 


Plot 


Nuclear 


Jihad 


Nationalist 


Chemical weapon 


Taliban 


Recruitment 


Biological weapon 


Weapons cache 


Fundamentalism 


Ammonium nitrate 


Suicide bomber 


Islamist 


Improvised explosive device 


Suicide attack 




Weather/Disaster/Emergency 






Emergency 


Ice 


Mud slide or Mudslide 


Hurricane 


Stranded/Stuck 


Erosion 


Tornado 


Help 


Power outage 


Twister 


Hail 


Brown out 


Tsunami 


Wildfire 


Warning 


Earthquake 


Tsunami Warning Center 


Watch 


Tremor 


Magnitude 


Lightening 


Flood 


Avalanche 


Aid 


Storm 


Typhoon 


Relief 


Crest 


Shelter-in-place 


Closure 


Temblor 


Disaster 


Interstate 


Extreme weather 


Snow 


Burst 


Forest fire 


Blizzard 


Emergency Broadcast System 


Brush fire 


Sleet 

Cyber Security 




Cyber security 


2600 


Hacker 


Botnet 


Spammer 


China 


DDOS (dedicated denial of 


Phishing 


Conficker 


service) 


Rootkit 


Worm 


Denial of service 


Phreaking 


Scammers 


Malware 


Cain and abel 


Social media 


Virus 


Brute forcing 




Trojan 


Mysql injection 




Keylogger 


Cyber attack 




Cyber Command 


Cyber terror 
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3 Personally Identifiable Information (PII) Guidance: 

PII refers to information that can be used to uniquely identify, contact, or locate a single person 
or can be used with other sources to uniquely identify a single individual. Before sending out 
ANY reports, including IOIs, ]\al331 analysts must ensure that if there is any PII included in a 
media article, that information must be removed, due to privacy issues! (Figure 6, IOI Example 

) 

Generally, both MMC and SN must never send out any IOIs with PII included except in 
"extremis situations". An extremis situation occurs when there is an imminent threat of loss of 
life, serious bodily harm, or damage/destruction to critical facilities or equipment (in these 
circumstances, the appropriate DHS OPS authority must approve PII, in which case, TSI 
management would need to be made aware of the situation). Note: The DHS OPS authority 
includes OPS Senior Executive leadership and the SWO. 

The following are cases in which PII must be removed from all MMC reports: 

1) Names, positions, or other information that would enable someone to determine the 
identity of a particular person 

a. The Privacy Impact Assessment (PIA) allows for certain exemptions in which PII 
may be included to identify spokesmen, government officials and reporters. Note: 
Refer to section 3.1 and the current PIA for more information 

2) Names of known or suspected terrorists, DTO leaders, or other individuals who are a 
threat to homeland security, regardless of whether a U.S. citizen or non-U.S. citizen 

3) Links to the actual articles or postings referenced provided the links themselves do not 
contain PII. In this case the analyst would use "No Link Due To PII" instead of the 
actual link. 

4) Addresses that would reveal where a person lives. In this case the analyst would either 
delete the street address completely generalize it to the street block. Example: instead of 
using "1345 John Doe Avenue", the analyst could use "the 1300 block of John Doe 
Avenue". 



Note: The MMC watch may provide the name, position, or other information considered to be 
PII to the NOC over the telephone when approved by the appropriate DHS OPS authority. But 
that information must not be stored in a database that could be searched by an individual's PII. 
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3.1 Effective: January 7, 2011 

OPS conducted an update to the Privacy Impact Assessment (PIA) allowing the Media 
Monitoring Capability to now collect and disseminate PII for certain narrowly tailored 
categories. Furthermore, PII on the following categories of individuals may be collected when it 
lends credibility to the report or facilitates coordination with federal, state, local, tribal, 
territorial, foreign, or international government partners: 

1) U.S. and foreign individuals in extremis situations involving potential life or death 
circumstances; (this is no change) 

2) Senior U.S. and foreign government officials who make public statements or provide 
public updates; 

3) U.S. and foreign government spokespersons who make public statements or provide 
public updates; 

4) U.S. and foreign private sector officials and spokespersons who make public statements 
or provide public updates; 

5) Names of anchors, newscasters, or on-scene reporters who are known or identified as 
reporters in their post or article or who use traditional and/or social media in real time to 
keep their audience situationally aware and informed; 

6) Current and former public officials who are victims of incidents or activities related to 
Homeland Security; and 

7) Terrorists, drug cartel leaders or other persons known to have been involved in major 
crimes of Homeland Security interest, (e.g., mass shooters such as those at Virginia Tech 
or Ft. Hood) who are killed or found dead. 

NOTE: PII on these individuals may include: 1) full name; 2) affiliation; 3) position or title; and 
3) publicly-available user ID. Analysts are trained to use only approved PII that is easily 
identifiable and to ignore and exclude any non-authorized PII. Practical implementation: the 
PII must add value, i.e. we can now say Sheriff or Fire Chief, but if the name is not important 
(and it usually isn't) don't include the name, just the title, especially for lower level officials. 
Should PII come into the NOC's possession, apart from these categories, the NOC shall redact it 
prior to further dissemination of any collected information. (Current PII retraction procedures do 
not change) 

What was NOT Approved: 

- We will not report on Individuals suspected or accused of committing crimes of National or 
Homeland Security interest, if captured, (see # 7 above for the exception if they are killed or 
found dead) 

- We will not report on Private citizens no matter if they are witnesses, victims, observers or 
some other way connected to an event 

- We will not report on high profile people such as celebrities, sports figures or media members 
who are victims, (see # 6 above for the exception if they are current or former public officials) 



25 



Analyst's Desktop Binder I 2011 



Operational Summary Guidance: 

Night shift analysts will compile a summary of items that have been distributed by the MMC 
over each 24 horn - period. The Operational Summary provides a synopsis of distributed items 
based on a set of designated priorities that are generated by the NOC. In rare circumstances, 
the NOC may require that Operational Summaries be generated at irregular intervals in 
support of ongoing situations. These special reports will be generated at the direction of the 
NOC or senior personnel, and will be highly coordinated with TSI senior management before 
distribution. 

Both the on duty Traditional and Social Media Analysts will collaborate to generate a single 
report and then submit it to the designated TSI Senior Reviewer no later than 0400. The 
Senior Reviewer will check the report for proper grammar, punctuation, and adherence to the 
NOC Priorities. Once the Senior Reviewer has approved the Operational Summary, the on 
duty Traditional Media Watch analyst will distribute it. 

• One copy of the OPSUM will be sent to the IOI Distro List using the BCC line. 

• A se cond (Identical) copy will be sent to: 
o ■(*)■(*]■ I n the TO Tine 



o 



(b) (6) 

(0) (6) 

(D) (tij 

(b) (6) 



in the BCC 



Lme 
• The OPSUM must not be distributed any earlier than 0445, and no later than 0500 

unless an early production call is issued by the NOC. If an early production is requested 
the on duty analysts in responsible for notifying the TSI Senior Reviewer for that shift 
as soon as possible that the time production time has been adjusted. 

4.1 Operational Summary (OPSUM) Format: 

Operational Summaries (OPSUM) are distributed each morning to provide recipients 
with the most current statistics for ongoing situations (e.g. NSS/ISSs, Steady-States), and 
events of high media interest. As such, the OPSUM format directly reflects the published 
NOC Priorities. Analyst will gather the most current media information on the active 
situation(s) for the summary. The most current information is considered information not 
older than 24 hours and will include information from previous IOIs in addition to 
scanning for new information and relevant updates. It is important to remember that the 
Operational S ummar y is used for agency briefings and must relay the most current 
information in a structured and easily readable format. 

Note: If there was a NOC item during the previous 24 hours that was closed out prior to 
the drafting of the morning OPSUM, it may be included if there was significant coverage 
by the MMC or heavy interest on part of the NOC while the item was active. 

• The OPSUM is created in an Outlook email message. 

• The standardized subject line is used for the report 

• A short summary of the topics covered in the report will also be included in a 
header for the OPSUM 

• Analyst will utilize a header and bullet format when inputting information. 
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o To distinguish between Traditional and Social Media items, all Social Media 
input will be italicized. Social Media analysts will also include (Social Media) 
at the end of each bullet as an additional designator. 
Sources will be included with the bullets for items of high interest or particularly 
controversial summaries. SN analysts will include links to translated articles if using 
foreign language sources. 



NOC MEDIA MONITORING OPERATIONAL SUMMARY (OPSUM) 

24 Hour Summary, August 16, 2011 

TODAY'S OPSUM COVERS THE FOLLOWING NOC PRIORITIES 
• NOC Priority Items with new information 



Southwest Border Violence 



Other Significant Items 

Severe Weather 



o 



Hyper Links Take Reader To Relevant 
Sections 



■ KY/IN 



Items Identified on NOC Priorities 
but not reported By MMC/SN 



(Social Media) 
designates 

contributions from SN 
Sources. NOT BOLD 



Al Qaeda Urges Attacks Against U.S. 
Continued Violence in Syria 
• NOC Priority Items (Nothing Significant To Report (NSTR)) 4 

Commercial Aviation Cargo Threats/Incidents in the U.S. and Overseas 

o Indications of Mass Migration in the Caribbean 

o CBRNE Threats/Incidents in the U.S. and its Territories 

NOC 0003-11: Southwest Border Violence - U.S./Mexico Border 



Killings (non U.S. persons) 

The Mexican Army captured the suspected leader of a Beltran Leyva drug cartel who allegedly controlled 
drug trafficking in the Costa Grande region of Guerrero state and orchestrated a number of killings Fox 
News Latino 



The suspect had ta ken over the Beltran Leyva cartel's operations in the city of Zihuatanejo, 
Guerrara, after th^ arrest of one of his bosses, unleashing a wave of executions of rival group 



members 

Killings (non U.S. persons) (Social Media) 

• Three separate grenade attacks in Mexican cities over the weekend have resulted in 1 death and / injuries 
Milenio News [Trdnsldted by Google] 

o The dttdcks occurred dt a prison in ApoddCd, Nuevo Leon; on a busy tourist boulevdrd in 
Verdcruz; dnd dt a movie thedter in Reynosd 

• The director of the Ixtldhudcdn del Rio Police wds executed on Sdturddy night in dn dmbuldnce in the 
municipdlity of Cuquio Guerrd Contm El Ndrco [Trdnsldted by Google] 

o Medicdl stdff confirmed thdt the vehicle wds intercepted by dn unknown number of individudls on 

the Rio-Cuquio Ixtldhudcdn highwdy dt Sdn Judn del Monte 
o The murderers bedt emergency medicdl technicidns dfter the execution dnd fled 



Other Impacts of Southwest Border Violence (SWBV) 

• As part of the Central American Law Enforcement Exchange, law enforcement officers from Latin America 
are training with local police in Los Angeles on combating international gang crimes, especially narcotics 
trafficking, kidnapping and human trafficking 

o The Exchange features a week-long training class made up of about 30 officers from the U.S., El 

Salvador, Panama, Costa Rica, Honduras and other countries, 
o FBI Officials said Los Angeles stands to benefit from the collaboration because there are up to 500 
gangs in the area ranging between 5,000 and 7,000 members. 



Sources 
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Bullets 
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Significant 
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OTHER SIGNIFICANT EVENTS: 

Severe Weather — Kentucky / Indiana (Social Media) Twitter [WAVE 3 News] 

• As of 3:00 a.m. [16 Aug] local time, LG &E's outage map was reporting less than 12,000 customers 
without power in Jefferson County, down from a peak of over 128,000 Saturday night 

LG & E hopes to have a majority of customers back up and running Monday and Tuesday, and the 

remaining by Wednesday 
The Jefferson County Public School system cancelled all classes on Monday due to power outages 
in the area 
Duke Energy reports 1,516 outages remaining across 5 Indiana counties 



1 



New Al Qaeda Leader Urges Attacks on the U.S. Fox News (AP) 

• In a video posted on militant websites Sunday, Al Qaeda' s new leader called on followers to avenge the 
killing of Osama bin Laden and to continue the Islamist jihad against America 

The leader also stated that uprisings in Egypt and Tunisia have presented Al Qaeda with 

opportunities to spread its message throughout the Arab world 
Al Qaeda has tried to forge a role for itself in the recent uprisings though it has little in common 
with the mainly youth activists behind the protests.... most uprising leaders say they seek greater 
freedoms, not Islamic states 



Continued Violence in Syria Reuters 

• Syrian forces shelled residential districts in Latakia on Monday, the third day of an assault on Sunni 
neighborhoods of the port city 

Approximately 35 people, and possibly more, have been killed in the city since the assault on 
Latakia began on Saturday, activists and witnesses say (Social Media) 

• More than 5,000 Palestinian refugees have fled a camp in Latakia (Social Media) 

It was not immediately clear where the refugees were seeking shelter (Social Media) 
A UN spokesman reports that "there were 10,000 refugees in the camp" prior to the attack (Social 
Media) 

• Separately, troops conducted raids and arrests in the village of Houla 

• UN authorities cite reports that Syrian security forces have opened fire on defectors within their own ranks 
and executed troops that refused orders to kill civilians (Social Media) 

"There are indications that more than 300 security forces or army personnel have died, in 

circumstances that remain to be elucidated, but could include clashes with armed opposition as 
well as internal executions of defecting soldiers," officials said (Social Media) < 



TBack to topi 



Link takes reader back to 
top of report 
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DHS NOC Media Monitoring 
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(Social Media) designates 
contributions from SN Sources. 
NOT BOLD 
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Retrieving NOC Priorities from Homeland Security Information 
Network (HSIN): 

The National Operations Center publishes a daily NOC Priorities report every 24 hours to 
identify the priorities for each shift and help guide the information gathering activities of 
NOC personnel. This report is usually distributed via email from the NOC between 2000- 
2300 each day. Analyst should use the priorities report to direct their reporting and as a guide 
for the generation of the Operational Summary. 



■ 



u _4i _* kjjj fe *«— & r * *::„ 






-■•■■-- ' :;."f 



■-B- 



■t I*-*" 



rni ■ -n^l tt*i j_tifcinuji.ini 
IV &«fc,I^M^;-n7l3W!F7?WST'S^^ '-'■■- HlllfTrim 



■mi rttao.iJ,Mij7.:jAM 



a^ 



]WX Piiniriir. inrl l.fenflnnn; Drum) !m ST imuil »)l 4ftN*il f i dati i]T HI) 






rr 



LhClASSIFIEDr.-FOfl OFFICIAL USE OKLY 
U. 5. 3tpjrn-i-i n J Hnmiland Sacunty 

Qfllc* of Optrjwns Cooridlnjdonind punning 
NOC PrinrfMa and Monitoring Rupert 

3d. Hour Duiroak tar ff Augun 3011 - Unditi 1 



1 NOC Fmmtws and ir*ms t>i l«tfere™t 

Eita*wCtnifTuiii«tir4 Si^on $ECR£TAftV *nd CEPUtV £ECKiTT*AY 

NOC 03 1 £- i 1 Saradr S;«c - TS EfflMEd* - Ctni al FKifie 

NOCOMB-lt SoulhttKtBontwVidence 

NOCOOOO't CumnwfeiBl AMBifln r;»:gfl fhf eaHflCH*Enl^ m he tf s HndCveHftH 

NOC OIIKkll lrdii:«i.om ur I.'kw MigDiliBE m LImsCmiUkjh 

NOC QQt2-1t CBRN6 Thfw&lrttttows mififi U 5 and (s TGmLorrci 

0«g [ ..■.:, J1 , JH ?**(*** 

£ECft£1V«Y. NCR 
DEPUTY SEGREFARV NCR 
QP3 Ltrtmbc 
□waor NCR 

DHS Smvi SjH RcjutfUb Tut InfmfiwlKn ' Evn« Suskmi NTR 



5.1 NOC Priorities (HSIN Retrieval) 

These instructions should be utilized as a means of retrieving the National Operations 
Center Priorities for each shift should there be a malfunction in the automated forwarding 
system. 

1) Step One: Access the Homeland Security Information Network 



H5IN Government Portal 

Home 




Your Contact Card 




Orgs nEStion I 

First Name: 

Middle Initial: . 

Last Name; 

Ern-fli-l Address: 
Mobile Email Address: 
Trtler 

Adcess- Nam*: 
Address Una u 
Adds-MoLmo 2; 
Cttf.; 

State: 

Postal Coder 

Country; 

First Choice of Contact; 
SECD-nd Choice, or Contact: 
Third Choice of Contact: 


TECH DP Eolations International 
Michael 


v our Address Sook 
Edit Ydl* - [information 

Changs Your Pascncd 
View Community List 


b 6 , b 7 C ■ ' M 


Ope*-ations Center Media Analyst 

jgjBHBH 

WashinntrjnD.C. 

2QQL6 " 
Unitod Ststoa 
EmailAddress 
IHiMtrw : = hone 


[Qajsn3ia:(a] 

Mobil e Phone : ^^^^^^^™ 
Ottier Rione: 


your Co^nmunitioB 

Federal 
Emeffjen-cy Manaflemanl 
Federal Operations' 
H3]N Government Home 
National Operations Center 
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2) Step Two: Select the National Operations Center Tab in the lower left earner. 





Kager: 
Other Phone: 




Your Communities 
Federal 

Emergency Management 

Federal Operations 
^k HSIN Government Home 

National Operations Center 







3) Step Three: Select the Library Tab. 




HSIN 



! I NJ. Watch Desks | Library I Tr amino | H5IH Database ! COP | support 



ral [ipergtions Center 
fruriicernents 

■Jew [tern | ^Fitter 



t 




iteragency Threat Assessment and Coordination Group Brochure 

SIN System Migration 

OC Watch COOP Familiarization Tour (March 3008) 

OC Cornmunrt/ of Interest architecture modification 



-ndar 



4) Step Four: Scroll down to the document library section. 
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Home | NOCWatchDcsks | Library | Training | HSIN Database | COP | Support 



National Operations Center 
NOC Watch Desk SOPs 



i BJI Crisis Action Process Operating Instructions (v. 10 as of 17 Apr 07-SWS) 

i3] IIMG SOP (02 23 OS) 

* BQ JFO SOP Appendix-Annexes (v55) 



Q Add new document 



Type Name 

■Q 11000-14 identification Access Control Card Request 

|3g| 11000-25 Contract Suitability-Security Screening Request Form 

§| 3130 DHS Non-Staff Assignment Form 

St] NAC Access Control - Visitor Access Form 

^3 NAC Access Control and Visitor Access Procedures (memo 9-26-06) 



a Add new document 



«" 



Type Name 

^] DHS OPS-HSOC-NOC SA-COP Brief 24 May 06 

9t1 The Evolution of HSOC Situational Awareness 03 April 2006 R.EV4_hurricarte_ version 

Ha DHS CINT Intelligence Notes 

r*g DHS Cyber Daily Reports 

DHS Daily Ops Report 

t=EMA National SITREP 



El 
Ca 



NOAA Meteorological Update 

NOC Priorities and Monitoring Reports 



5) Step Five: Select the NOC Priorities folder: 



Type Name 


£ 


*3] DHS OPS-HSOC-NOC 5A-COP Brief Z4 May 06 

Plf) The Evolution of HSOC Situational Awareness 03 April 2006 REV4_hurricane_version 

^ DHS CINT Intelligence Notes 


(b)(6), (b)(7)(C) 




C3 DHS Cyber Daily Reports 


Ca DHS Daily Ops Report 


ES FEMA National SITREP 

f^ NOAA Meteorological Update 

P^ NOC Priorities and Monitoring Reports -*^^^bbbbbbbbbbbbbbbbbibbm 


h Add new document 



Operations Directorate COOP Documents 
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6) Step Six: When the folder opens, scroll down to the Document Library 



[ICIM National Operations 
nrDIIM Center [NQQ AW* 



tsmm ~i i 



Home | HOC Watch Desks | Library | Training | HSIN Database | COP | Support 



National Operations Center 
NOC Watch Desk SOPs 



^] Crisis Action Process Operating Instructions (v.10 as of 17 Apr 07-SWS) 

§ IIMG SOP (02 23 05J 

W\ JFC SOP Appendix-Annexes (vBSj 



h Add new document 



A Modified By 




Type Name 

^1 Li.000-14 Identification Access Control Card Request 

J pQj| 11000-25 Contract Suitability-Security Screening Request Form 

13^ 3 -— DHS Non-Staff Assignment Form 

@f| NAC Access Control - Visitor Access Form 



NAC Access Control and Visitor Access Procedures (memo 9-26-06) 



1 Modified By- 




Ei Add new document 



Document Library 



NOC Priorities and Monitoring Report 5 December 2003 I new 
NOC Priorities and Monitoring Report 4 December 2003 



h Add new document 



rations Directorate COOP Documents 



i Modified By 



(b)(6), (b)<7)(c; 



7) Step Seven: Select the NOC Priority list for the desired date: 









Tvoe Name ^ , ± J _ L _ ;■_■__ ,, 




■ AL&. •' *j 




U3' 5 ! NOC Priorities and Monitorina Report 4 December 2003 ^^^ 


■■I 


h Add new document 
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6 Audio Video System: 



6. 1 Direct TV Full Channel List 



A&E 265 

ABC Family 311 

American Movie Classics (AMC) 254 

America's Store 243 

Animal Planet 282 

BBC America 264 

The Biography Channel 266 

Black Entertainment Television 

(BET) 329 

Bloomberg Television 353 

Boomerang 297 

Bravo 273 

BYU TV 374 

Cartoon Network 296 

CCTV-9 (Chinese) 455 

The Church Channel 371 

CNBC 355 

CNBC World 357 

CNN 202 

Comedy Central 249 

Country Music Television (CMT) 327 

Court TV 203 

C-SPAN 350 

C-SPAN2 351 

CSTV: College Sports Television 

610 

Current TV 366 

Daystar 369 

Discovery Channel 278 

Discovery Health Channel 279 

Discovery Home Channel 286 

Discovery Kids 294 

Discovery Times Channel 285 

DIY Network 230 

El Entertainment Television 236 



EWTN 422 

FINE LIVING 232 

FitTV 368 

Food Network 231 

Fox News Channel 360 

Fox Reality 250 

FUELTV612 

Fuse 339 

FX248 

G4 videogame tv 354 

Galavision 404 

GolTV 426 

Great American Country 326 

GSN: the network for games 309 

Hallmark Channel 312 

Headline News 204 

The History Channel 204 

History International 271 

HITN TV+438 

Home & Garden Television 229 

Home Shopping Network 240 

The Learning Channel {TLC) 280 

Lifetime 252 

Lifetime Real Women 261 

Link TV 375 

The Military Channel 287 

MSNBC 356 

MTV 331 

MTV2 333 

National Geographic Channel 276 

NASA TV 376 

NBA TV 720 

News Mix 102 

NRB Network 378 

NFL Network 212 



Nickelodeon/Nick at Nile (East) 299 

Nickelodeon/Nick at Nile (West) 300 

Nicktoons Network 302 

Noggin/The N 298 

Outdoor Channel 606 

OLN 608 

ONCEMexico t 415 

Oxygen 251 

QVC317 

RFD-TV 379 

Sci-Fi Channel 244 

Speed 607 

Spike TV 325 

Superstation WGN 307 

TBS 247 

TCT Network 377 

TNT 245 

Travel Channel 277 

Trinity Broadcasting Network (TBN) 

372 

Turner Classic Movies (TCM) 256 

Turner South* 631 

TV Guide Channel 224 

TV Land 301 

TV One 241 

TVGThe Interactive Horseracing 

Network 602 

Univision402 

USA Network 242 

VH1 335 

VH1 Classic 337 

The Weather Channel 362 

The Word 373 

World Harvest Television (WHT) 321 



6.2 Direct TV Account Information 



Contac 



(b)(6), (b)(7)(C) 



6.3 Online Audio-Video Switch 

In order to change the channels for the displays at t he front of the MMC office, analyst must 
access the TSI network at: http: 



b 7 E 



Username:!!- 
Password 




ere is one universal usemame/password for everyone) 



It's probably a good idea to have this interface available during your shift, so that you can make 
any adjustments on the fly. 

Manual Switching 

Using the matrix of Inputs (along left side) and Outputs (along top side) you can quickly click 

which source you would like to display on any one of 5 outputs. Selection is made by clicking 
the button that references the combination of Input and Output you wish to see, and then click 
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the "Submit" button at the bottom of the page. Outputs 1 through 4 correspond to the TVs left to 
right, from top row to bottom row: 



ONE 


TWO 


THREE 


FOUR 



Output 5 allows you to assign the audio of any input to the overall room speakers. 

Stored Configurations 

To make common configurations easily and quickly available, we have set up some presets. By 
selecting the number from the drop-down menu under "Stored Configurations" and clicking 
"Load", you can call up these stored presets. These settings can be changed if we find specific 
presets that are preferred. 

1) MMC Extended Desktop HSIN (1), CNN (2), FOX News (3) MSNBC (4). 

2) MMC Extended Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

3) MMC Extended Desktop HSIN (3), CNN (2), FOX News (1) MSNBC (4). 

4) MMC Extended Desktop HSIN (4), CNN (2), FOX News (1) MSNBC (3). 

5) SN Extended Desktop HSIN (1), CNN (2), FOX News (3) MSNBC (4). 

6) SN Extended Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

7) SN MAC Desktop HSIN (2), CNN (1), FOX News (3) MSNBC (4). 

8) SN MAC Desktop (3), CNN (1), FOX News (2) MSNBC (4). 
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7 HSIN^myg Connection Instructions: 

QuU||| is a Text based cornniunications tool utilized by the D epartme nt of Homeland Security to 
connect individuals at different locations. The MMC utilizes [j||jjjjjj as a means to communicate 
with members of the NOC Watch throughout the shift. The NOC has a dedicated chat room, 
identified as NOCWatch in which all members of t he NOC Watch team can post information 
regarding ongoing incidents. MMC analysts will useUijjUH to pass information on rapidly 
evolving situations, request information and conmiumcatedirectly with the SWO, KMO or 
NDD. 

Once logged into HSIN. click on theB||IBj||do\\iiload box on the right side of the Emergency 
Management Portal. After selecting tneljgUb|jJ full client download, you will be provided with 
theijjj |jLj|j EXE file. Once the download is complete, follow each of the instructions given by the 
prompt wmdows until the installation process is complete. 

After the file is insta lie d analy sts will need to adjust the programs configuration settings. When 
the login screen for thetj||j||H thick client conies up there a couple settings that need to be 
entered into the login screen to set up the connection. This information includes the domain you 
will be connecting to, your login credentials, and the port that will be used for the connection. 
Any variants in this information could result in a user having issues connecting to the necessary 
servers. 

The initial login screen prompts the user for fairly basic information. This information includes a 
usemame, password, domain, and also asks if you want to use an existing account or crea te a 
new one. The ability to create a new account is not functional in this release of the j|2UusJ thick 
client software, resulting in an error message when users attempt to do this. The res t of the 
information, with exception of resource is mandatory to successfully log into HSINF 



The usemame and password are specific to each individual user that is going to be logging into 
the client software. However, the domain information is going to consistent for all users. The 
domain that needs to be supplied is "hsin.gov". Once this information has been entered it allows 
the user to save then password, this is not suggested for security reasons. 
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Account Information 

Enter your account Information. 



C 1 want to create a new account 
©I have an existing account 



Lfeamame 


| john.doe 






Password 


| ************ 






Domain 


J hsln.gov 






Resource 


W2HS531 < 



Note: Resource names identify the client where you are logged in. IF you are 
online with multiple clients at the same bme, a unique identifier is necessary to 
route messages accurately. Provide a unique resource name to describe 
this client/location. Example: Home, Work, Mobile, etc. 

Q5ave my password 

Automatically login with this Information 



Nes<t> Finish Cancel 



The seco nd screen for the user login requires that the use r enter the hostname which 
should he^B*/yi XC|iis 1 «H' ^ ie P or * wn * cn should heUMJ|j|| and the connection type 
to establish "select the checkbox that reads Use a secure connection". Note, after entering 
port 443 and selecting the chec k box, the port number may change and you need to make 
sure you change it back («■§■ again and then click next. These settings will remain 
consistent for all the users accessing HSIN|jfi 



Connection Information 

Enter yuur connection hFarrration 
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After clicking on next, the following screen will appear and you must select "Accept for 
all sessions" 



t Invalid SSL Certificate X 


SSL Warning! 
The server has sent you an invalid certificate. 


Accept for this session only Accept for all sessions 


Reject this certificate 
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8 Usernames, Passwords & Contact Information: 



8.1 Passwords 



-SN 



MMC Wifi Network: 

Network Name: MM C 

Passwoidj^^g 

Network Name^MM C' -SN (BackUp) 

Password: 



MMC Telephones: 

MMC Office Voicernai 
SN Office Voiceniail: 
Blast Call Cell Phone 






Desktops & Apple Mac Mini: 

MMC Desktop: 
MMC Mac: 
SNMC Mac: 
MMC Outlook 
Meltwater 



U: MMC Analyst 
U: MMC Analyst 
U: snmc analyst 
U: 
U: 



(b) (6) 



(b) (7)(E) 



Shared Drives 

MMC Address 
SN Address 
Usemarne:[ 
Password 



(b) (7)(E) 



(b) (7)(E) 



MMC DHS Email (BackUp) 

https://coiniect.dhs.gov (functions only in Microsoft Internet Explorer) 
Usemame: I 

Password ^Ef,BHCfIt3^H (changes every 90 days) 
Password ] 



(b) (7)(E) 
(b)(6) 



b 7 E 



Video Switch: 

Address: | 

Click "VIDEO SWITCH" 

Usemame:! 

Password: 



Twitter/ Tweet Deck: 
Twitter: 
Usemame: DHSr : 

Password: 
TweetDecI 
Email: 
Passworc 



;k 




b) (6) 
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8.2 TSI Senior Reviewers 

The SWO/KMO: 




lroom:NOC Watch 



HSIN Help Desk: 

HSIN Help Desk 




TSI Senior Reviewers: 
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